PT-2026-23407 · Humhub · Humhub Calendar

Lassi · Publicado 2026-03-05 · Atualizado 2026-03-09 · CVE-2026-29052

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HumHub Calendar module versions prior to 1.8.11

Description The Calendar module for HumHub allows users to create and manage events. A stored cross-site scripting (XSS) issue exists in the Event Types functionality of the Calendar module for versions prior to 1.8.11. This impacts users viewing events created by an administrative account. The issue allows an attacker to inject malicious scripts into the application through the Event Types feature. The vulnerability is triggered when a user views events created by an administrative account.

Recommendations Update to HumHub Calendar module version 1.8.11 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-29052

GHSA-GQJ3-PMP2-MRX8

Produtos afetados

Humhub Calendar

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29052.json · Exploit
• https://github.com/humhub/calendar/security/advisories/GHSA-gqj3-pmp2-mrx8 · Aviso do Fabricante
• https://github.com/humhub/calendar/releases/tag/v1.8.11 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-29052 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-29052 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2030755407048696241 · Publicação no Twitter
• https://t.me/cveNotify/154854 · Publicação no Telegram
• https://t.me/CVEtracker/46414 · Publicação no Telegram